CGNAT makes all ISP users appear to come from one v4 address, so blocking by v4 address becomes unworkable.